CVE-2016-4053
Low · 3.7CVSS
3.7
EPSS
14.4%
Published
Apr 25, 2016
CISA due date
—
The record
Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:7 | squid3 | 0 | 3.1.20-2.2+deb7u5 |
| Debian:8 | squid3 | 0 | 3.4.8-6+deb8u3 |
| Red Hat:enterprise_linux:6::server | squid | 0 | 7:3.1.23-16.el6_8.4 |
| Red Hat:enterprise_linux:6::server | squid-debuginfo | 0 | 7:3.1.23-16.el6_8.4 |
| Red Hat:enterprise_linux:6::server | squid34 | 0 | 7:3.4.14-9.el6_8.3 |
| Red Hat:enterprise_linux:6::server | squid34-debuginfo | 0 | 7:3.4.14-9.el6_8.3 |
| Red Hat:enterprise_linux:6::workstation | squid | 0 | 7:3.1.23-16.el6_8.4 |
| Red Hat:enterprise_linux:6::workstation | squid-debuginfo | 0 | 7:3.1.23-16.el6_8.4 |
| Red Hat:enterprise_linux:6::workstation | squid34 | 0 | 7:3.4.14-9.el6_8.3 |
| Red Hat:enterprise_linux:6::workstation | squid34-debuginfo | 0 | 7:3.4.14-9.el6_8.3 |
| Red Hat:enterprise_linux:7::server | squid | 0 | 7:3.3.8-26.el7_2.3 |
| Red Hat:enterprise_linux:7::server | squid-debuginfo | 0 | 7:3.3.8-26.el7_2.3 |
| Red Hat:enterprise_linux:7::server | squid-sysvinit | 0 | 7:3.3.8-26.el7_2.3 |
| Red Hat:enterprise_linux:7::workstation | squid | 0 | 7:3.3.8-26.el7_2.3 |
| Red Hat:enterprise_linux:7::workstation | squid-debuginfo | 0 | 7:3.3.8-26.el7_2.3 |
| Red Hat:enterprise_linux:7::workstation | squid-sysvinit | 0 | 7:3.3.8-26.el7_2.3 |
| SUSE:Linux Enterprise Server 11 SP4 | squid3 | 0 | 3.1.23-8.16.30.1 |
| SUSE:Linux Enterprise Server 12 SP1 | squid | 0 | 3.3.14-20.2 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | squid3 | 0 | 3.1.23-8.16.30.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | squid | 0 | 3.3.14-20.2 |
| Ubuntu:14.04:LTS | squid3 | 0 | 3.3.8-1ubuntu6.8 |
| Ubuntu:16.04:LTS | squid3 | 0 | 3.5.12-1ubuntu7.2 |
Related vulnerabilities
- CVE-2016-10002 Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid… Also affects squid3
- CVE-2016-4556 Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10… Also affects squid3
- CVE-2016-4555 client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote… Also affects squid3
- CVE-2016-4554 mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended… Also affects squid3
- CVE-2016-4054 Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers… Also affects squid3
- CVE-2016-4052 Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9… Also affects squid3
- CVE-2016-4051 Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9… Also affects squid3
- CVE-2015-5400 Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured… Also affects squid3